637 lines
26 KiB
Bash
Executable File
637 lines
26 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# 격리 복구 결과를 만들고 운영 host의 복구 증거를 등록·검사한다. source-safe
|
|
# 함수 경계는 fixture가 live/root side effect만 치환할 수 있게 유지한다.
|
|
set -Eeuo pipefail
|
|
|
|
if [[ "${BASH_SOURCE[0]}" == */* ]]; then
|
|
readonly KSRE_SCRIPT_DIR="${BASH_SOURCE[0]%/*}"
|
|
else
|
|
readonly KSRE_SCRIPT_DIR='.'
|
|
fi
|
|
readonly KSRE_ROOT="$(cd -- "${KSRE_SCRIPT_DIR}/../.." && pwd -P)"
|
|
readonly KSRE_STATUS_VALIDATOR="${KSRE_ROOT}/scripts/validate/k3s-secret-encryption.sh"
|
|
readonly KSRE_POST_BUNDLE='/etc/rancher/k3s/platform-post-bundle.env'
|
|
readonly KSRE_EVIDENCE='/etc/rancher/k3s/platform-restore-evidence.env'
|
|
readonly KSRE_VERSION='v1.36.2+k3s1'
|
|
readonly KSRE_KUBECTL='/usr/local/bin/kubectl'
|
|
readonly KSRE_LOCAL_API_SERVER='https://127.0.0.1:6443'
|
|
readonly KSRE_SECURE_PATH='/usr/sbin:/usr/bin:/sbin:/bin'
|
|
readonly KSRE_BROKER_RUNTIME_TIMEOUT='2s'
|
|
readonly KSRE_BROKER_KILL_AFTER='0.5s'
|
|
readonly KSRE_BROKER_READY_TIMEOUT='3'
|
|
readonly KSRE_BROKER_ACK_TIMEOUT='1.0'
|
|
readonly KSRE_BROKER_REAP_POLLS='300'
|
|
readonly KSRE_BROKER_SIGNAL_POLLS='50'
|
|
readonly KSRE_BROKER_POLL_INTERVAL='0.01'
|
|
|
|
_ksre_fail() {
|
|
printf 'ERROR: 복구 증거 검증에 실패했습니다. 수동 절차를 확인하세요.\n' >&2
|
|
return 1
|
|
}
|
|
|
|
_ksre_usage() {
|
|
cat <<'USAGE'
|
|
사용법:
|
|
bash scripts/validate/k3s-secret-encryption-restore-evidence.sh \
|
|
--emit-result --bundle-metadata FILE --output FILE
|
|
bash scripts/validate/k3s-secret-encryption-restore-evidence.sh \
|
|
--record --bundle-metadata FILE --result-file FILE
|
|
bash scripts/validate/k3s-secret-encryption-restore-evidence.sh --check
|
|
|
|
--emit-result는 격리 복구 host의 live 상태를 검사한 뒤 결과 파일을 만듭니다.
|
|
--record는 복구 환경과 bundle 복사본 파기 확인 뒤 운영 host에 증거를 등록합니다.
|
|
--check는 권위 post bundle, live 암호화 상태와 등록된 증거를 읽기 전용 검사합니다.
|
|
USAGE
|
|
}
|
|
|
|
_ksre_allowed_key() {
|
|
local kind="$1" key="$2"
|
|
case "$kind:$key" in
|
|
bundle:schema|bundle:bundle_id|bundle:phase|bundle:k3s_version|bundle:datastore|bundle:created_at_utc|bundle:secret_count)
|
|
return 0
|
|
;;
|
|
result:schema|result:bundle_id|result:k3s_version|result:datastore|result:status_class|result:rotation_stage|result:hashes|result:local_integrity|result:api_ready|result:node_ready|result:isolation|result:secret_count_match|result:tested_at_utc)
|
|
return 0
|
|
;;
|
|
evidence:schema|evidence:bundle_id|evidence:k3s_version|evidence:datastore|evidence:rotation_stage|evidence:local_integrity|evidence:node_ready|evidence:isolation|evidence:tested_at_utc|evidence:recorded_at_utc|evidence:destroyed)
|
|
return 0
|
|
;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
_ksre_expected_field_count() {
|
|
case "$1" in bundle) printf '7\n' ;; result) printf '13\n' ;; evidence) printf '11\n' ;; *) return 1 ;; esac
|
|
}
|
|
|
|
_ksre_values_valid() {
|
|
local kind="$1" destination="$2"
|
|
local -n values="$destination"
|
|
[[ "${values[bundle_id]:-}" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ ]] || return 1
|
|
[[ "${values[k3s_version]:-}" == "$KSRE_VERSION" ]] || return 1
|
|
[[ "${values[datastore]:-}" == sqlite || "${values[datastore]:-}" == embedded-etcd ]] || return 1
|
|
case "$kind" in
|
|
bundle)
|
|
[[ "${values[schema]:-}" == platform-k3s-bundle-v1 &&
|
|
( "${values[phase]:-}" == pre || "${values[phase]:-}" == post ) &&
|
|
"${values[created_at_utc]:-}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ &&
|
|
"${values[secret_count]:-}" =~ ^[0-9]+$ ]]
|
|
;;
|
|
result)
|
|
[[ "${values[schema]:-}" == platform-k3s-restore-result-v1 &&
|
|
"${values[status_class]:-}" == enabled_stable &&
|
|
"${values[rotation_stage]:-}" == reencrypt_finished &&
|
|
"${values[hashes]:-}" == match && "${values[local_integrity]:-}" == match &&
|
|
"${values[api_ready]:-}" == pass && "${values[node_ready]:-}" == pass &&
|
|
"${values[isolation]:-}" == pass && "${values[secret_count_match]:-}" == pass &&
|
|
"${values[tested_at_utc]:-}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
|
|
;;
|
|
evidence)
|
|
[[ "${values[schema]:-}" == platform-k3s-restore-evidence-v1 &&
|
|
"${values[rotation_stage]:-}" == reencrypt_finished &&
|
|
"${values[local_integrity]:-}" == match && "${values[node_ready]:-}" == pass &&
|
|
"${values[isolation]:-}" == pass && "${values[destroyed]:-}" == confirmed &&
|
|
"${values[tested_at_utc]:-}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ &&
|
|
"${values[recorded_at_utc]:-}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
|
|
;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
_ksre_parse_stream() {
|
|
local kind="$1" destination="$2" line key value count=0 expected
|
|
local -n output_fields="$destination"
|
|
output_fields=()
|
|
expected="$(_ksre_expected_field_count "$kind")" || return 1
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
[[ "$line" =~ ^([a-z0-9_]+)=([^=[:cntrl:]]+)$ ]] || return 1
|
|
key="${BASH_REMATCH[1]}"; value="${BASH_REMATCH[2]}"
|
|
_ksre_allowed_key "$kind" "$key" || return 1
|
|
[[ -z "${output_fields[$key]+present}" ]] || return 1
|
|
output_fields["$key"]="$value"
|
|
count=$((count + 1))
|
|
done
|
|
[[ "$count" == "$expected" ]] || return 1
|
|
_ksre_values_valid "$kind" "$destination"
|
|
}
|
|
|
|
_ksre_raw_stream_has_no_nul() {
|
|
/usr/bin/od -An -v -t u1 -- "$1" 2>/dev/null |
|
|
/usr/bin/awk '{ for (field = 1; field <= NF; field++) if ($field == 0) found = 1 }
|
|
END { exit(found ? 1 : 0) }'
|
|
}
|
|
|
|
_ksre_parse_external_fd() {
|
|
local kind="$1" input_fd="$2" destination="$3" handle metadata
|
|
[[ "$input_fd" =~ ^[0-9]+$ ]] || return 1
|
|
handle="/proc/self/fd/${input_fd}"
|
|
metadata="$(/usr/bin/stat --dereference --format='%u:%a:%F' -- "$handle" 2>/dev/null)" || return 1
|
|
[[ "$metadata" == "${EUID}:600:regular file" && -s "$handle" ]] || return 1
|
|
_ksre_raw_stream_has_no_nul "$handle" || return 1
|
|
_ksre_parse_stream "$kind" "$destination" <"$handle"
|
|
}
|
|
|
|
_ksre_broker_job_running() {
|
|
local expected_pid="$1" active_pid active_jobs
|
|
active_jobs="$(jobs -pr)"
|
|
while IFS= read -r active_pid; do
|
|
[[ "$active_pid" == "$expected_pid" ]] && return 0
|
|
done <<<"$active_jobs"
|
|
return 1
|
|
}
|
|
|
|
_ksre_reap_broker_bounded() {
|
|
local broker_pid="$1" attempt
|
|
for ((attempt = 0; attempt < KSRE_BROKER_REAP_POLLS; attempt++)); do
|
|
if ! _ksre_broker_job_running "$broker_pid"; then
|
|
if wait "$broker_pid"; then return 0; else return $?; fi
|
|
fi
|
|
/usr/bin/sleep "$KSRE_BROKER_POLL_INTERVAL"
|
|
done
|
|
/bin/kill -TERM "$broker_pid" 2>/dev/null || :
|
|
for ((attempt = 0; attempt < KSRE_BROKER_SIGNAL_POLLS; attempt++)); do
|
|
if ! _ksre_broker_job_running "$broker_pid"; then
|
|
wait "$broker_pid" 2>/dev/null || :
|
|
return 1
|
|
fi
|
|
/usr/bin/sleep "$KSRE_BROKER_POLL_INTERVAL"
|
|
done
|
|
/bin/kill -KILL "$broker_pid" 2>/dev/null || :
|
|
for ((attempt = 0; attempt < KSRE_BROKER_SIGNAL_POLLS; attempt++)); do
|
|
if ! _ksre_broker_job_running "$broker_pid"; then
|
|
wait "$broker_pid" 2>/dev/null || :
|
|
return 1
|
|
fi
|
|
/usr/bin/sleep "$KSRE_BROKER_POLL_INTERVAL"
|
|
done
|
|
return 1
|
|
}
|
|
|
|
_ksre_open_external_nofollow() {
|
|
local path="$1" destination="$2" broker_pid broker_read broker_write
|
|
local ready opener_pid opener_fd opened_descriptor='' rc=0
|
|
coproc KSRE_OPEN_BROKER {
|
|
exec /usr/bin/timeout --signal=TERM --kill-after="$KSRE_BROKER_KILL_AFTER" \
|
|
"$KSRE_BROKER_RUNTIME_TIMEOUT" /usr/bin/python3 -I -S -c '
|
|
import os
|
|
import select
|
|
import stat
|
|
import sys
|
|
|
|
required_flags = ("O_PATH", "O_NOFOLLOW", "O_CLOEXEC", "O_NONBLOCK")
|
|
if any(not hasattr(os, flag) for flag in required_flags):
|
|
sys.exit(1)
|
|
try:
|
|
path_descriptor = os.open(
|
|
sys.argv[1], os.O_PATH | os.O_NOFOLLOW | os.O_CLOEXEC
|
|
)
|
|
except OSError:
|
|
sys.exit(1)
|
|
try:
|
|
path_status = os.fstat(path_descriptor)
|
|
if not stat.S_ISREG(path_status.st_mode):
|
|
sys.exit(1)
|
|
try:
|
|
descriptor = os.open(
|
|
f"/proc/self/fd/{path_descriptor}",
|
|
os.O_RDONLY | os.O_CLOEXEC | os.O_NONBLOCK,
|
|
)
|
|
except OSError:
|
|
sys.exit(1)
|
|
try:
|
|
content_status = os.fstat(descriptor)
|
|
if (
|
|
not stat.S_ISREG(content_status.st_mode)
|
|
or content_status.st_dev != path_status.st_dev
|
|
or content_status.st_ino != path_status.st_ino
|
|
):
|
|
sys.exit(1)
|
|
print(f"{os.getpid()}:{descriptor}", flush=True)
|
|
readable, _, _ = select.select(
|
|
[sys.stdin.buffer], [], [], float(sys.argv[2])
|
|
)
|
|
if not readable or sys.stdin.buffer.read(1) != b"x":
|
|
sys.exit(1)
|
|
finally:
|
|
os.close(descriptor)
|
|
finally:
|
|
os.close(path_descriptor)
|
|
' "$path" "$KSRE_BROKER_ACK_TIMEOUT"
|
|
}
|
|
broker_pid="$KSRE_OPEN_BROKER_PID"
|
|
broker_read="${KSRE_OPEN_BROKER[0]}"
|
|
broker_write="${KSRE_OPEN_BROKER[1]}"
|
|
if IFS= read -r -t "$KSRE_BROKER_READY_TIMEOUT" ready <&"$broker_read"; then
|
|
if [[ "$ready" =~ ^([0-9]+):([0-9]+)$ ]]; then
|
|
opener_pid="${BASH_REMATCH[1]}"
|
|
opener_fd="${BASH_REMATCH[2]}"
|
|
exec {opened_descriptor}<"/proc/${opener_pid}/fd/${opener_fd}" || rc=1
|
|
else
|
|
rc=1
|
|
fi
|
|
else
|
|
rc=1
|
|
fi
|
|
if (( rc == 0 )); then
|
|
printf 'x' >&"$broker_write" || rc=1
|
|
fi
|
|
exec {broker_write}>&-
|
|
exec {broker_read}<&-
|
|
if (( rc != 0 )); then /bin/kill -TERM "$broker_pid" 2>/dev/null || :; fi
|
|
if ! _ksre_reap_broker_bounded "$broker_pid"; then rc=1; fi
|
|
if (( rc != 0 )); then
|
|
[[ -z "$opened_descriptor" ]] || exec {opened_descriptor}<&-
|
|
return 1
|
|
fi
|
|
printf -v "$destination" '%s' "$opened_descriptor"
|
|
}
|
|
|
|
_ksre_parse_external_file() {
|
|
local kind="$1" path="$2" destination="$3" input_fd rc=0
|
|
[[ -n "$path" ]] || return 1
|
|
_ksre_open_external_nofollow "$path" input_fd || return 1
|
|
if (( rc == 0 )); then _ksre_parse_external_fd "$kind" "$input_fd" "$destination" || rc=$?; fi
|
|
exec {input_fd}<&-
|
|
return "$rc"
|
|
}
|
|
|
|
_ksre_parse_trusted_content() {
|
|
local kind="$1" content="$2" destination="$3"
|
|
_ksre_parse_stream "$kind" "$destination" <<<"$content"
|
|
}
|
|
|
|
_ksre_current_context() {
|
|
/usr/bin/timeout --signal=TERM --kill-after=1s 9s \
|
|
"$KSRE_KUBECTL" config current-context 2>/dev/null
|
|
}
|
|
|
|
_ksre_require_same_context() {
|
|
local expected="$1" current
|
|
current="$(_ksre_current_context)" || return 1
|
|
[[ -n "$current" && "$current" == "$expected" && "$current" != *$'\n'* ]]
|
|
}
|
|
|
|
_ksre_validate_current_connection() {
|
|
[[ "$1" == "${KSRE_LOCAL_API_SERVER}|" ]]
|
|
}
|
|
|
|
_ksre_current_connection() {
|
|
local context="$1"
|
|
/usr/bin/timeout --signal=TERM --kill-after=1s 9s \
|
|
"$KSRE_KUBECTL" --context="$context" config view --minify \
|
|
-o 'jsonpath={.clusters[0].cluster.server}{"|"}{.clusters[0].cluster.proxy-url}' \
|
|
2>/dev/null
|
|
}
|
|
|
|
_ksre_require_same_connection() {
|
|
local context="$1" expected="$2" current
|
|
_ksre_validate_current_connection "$expected" || return 1
|
|
current="$(_ksre_current_connection "$context")" || return 1
|
|
[[ "$current" == "$expected" ]]
|
|
}
|
|
|
|
_ksre_now_rfc3339() { /usr/bin/date -u +%Y-%m-%dT%H:%M:%SZ; }
|
|
_ksre_now_epoch() { /usr/bin/date -u +%s; }
|
|
|
|
_ksre_timestamp_epoch() {
|
|
local timestamp="$1" normalized
|
|
normalized="$(/usr/bin/date -u -d "$timestamp" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)" || return 1
|
|
[[ "$normalized" == "$timestamp" ]] || return 1
|
|
/usr/bin/date -u -d "$timestamp" +%s
|
|
}
|
|
|
|
_ksre_age_within() {
|
|
local timestamp="$1" maximum="$2" now epoch age
|
|
now="$(_ksre_now_epoch)" || return 1
|
|
epoch="$(_ksre_timestamp_epoch "$timestamp")" || return 1
|
|
[[ "$now" =~ ^[0-9]+$ && "$epoch" =~ ^[0-9]+$ && "$maximum" =~ ^[0-9]+$ ]] || return 1
|
|
age=$((now - epoch))
|
|
(( age >= 0 && age <= maximum ))
|
|
}
|
|
|
|
_ksre_bundle_equal() {
|
|
local left_name="$1" right_name="$2" key
|
|
local -n left="$left_name" right="$right_name"
|
|
for key in schema bundle_id phase k3s_version datastore created_at_utc secret_count; do
|
|
[[ "${left[$key]}" == "${right[$key]}" ]] || return 1
|
|
done
|
|
}
|
|
|
|
_ksre_read_root_file() {
|
|
local path="$1" kind="$2" destination="$3" metadata temporary rc=0
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/test ! -L "$path" || return 1
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/test -f "$path" || return 1
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/test -s "$path" || return 1
|
|
metadata="$(/usr/bin/sudo --non-interactive -- /usr/bin/stat \
|
|
--format='%u:%g:%a:%F' -- "$path" 2>/dev/null)" || return 1
|
|
[[ "$metadata" == '0:0:600:regular file' ]] || return 1
|
|
temporary="$(/usr/bin/mktemp /tmp/platform-k3s-restore-read.XXXXXX)" || return 1
|
|
/usr/bin/chmod 0600 "$temporary" || { /bin/rm -f -- "$temporary"; return 1; }
|
|
/usr/bin/sudo --non-interactive -- /bin/cat -- "$path" >"$temporary" || rc=$?
|
|
if (( rc == 0 )); then _ksre_parse_external_file "$kind" "$temporary" "$destination" || rc=$?; fi
|
|
/bin/rm -f -- "$temporary"
|
|
return "$rc"
|
|
}
|
|
|
|
_ksre_read_authoritative_bundle() { _ksre_read_root_file "$KSRE_POST_BUNDLE" bundle "$1"; }
|
|
_ksre_read_installed_evidence() { _ksre_read_root_file "$KSRE_EVIDENCE" evidence "$1"; }
|
|
|
|
_ksre_inventory_value() {
|
|
local file="$1" key="$2" line found=''
|
|
while IFS= read -r line; do
|
|
[[ "$line" =~ ^([a-z_]+)=([A-Za-z0-9_.+-]+)$ ]] || return 1
|
|
if [[ "${BASH_REMATCH[1]}" == "$key" ]]; then
|
|
[[ -z "$found" ]] || return 1
|
|
found="${BASH_REMATCH[2]}"
|
|
fi
|
|
done <"$file"
|
|
[[ -n "$found" ]] || return 1
|
|
printf '%s\n' "$found"
|
|
}
|
|
|
|
_ksre_secret_count_from_stream() {
|
|
/usr/bin/jq -er '.items | length' 2>/dev/null
|
|
}
|
|
|
|
_ksre_require_same_ready_node() {
|
|
local local_node="$1" local_node_uid="$2" nodes_json="$3"
|
|
[[ "$local_node" =~ ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$ ]] || return 1
|
|
[[ "$local_node_uid" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ ]] || return 1
|
|
/usr/bin/jq -e --arg local_node "$local_node" --arg local_node_uid "$local_node_uid" '
|
|
[.items[] |
|
|
select(any(.status.conditions[]?; .type == "Ready" and .status == "True"))] |
|
|
length == 1 and
|
|
.[0].metadata.name == $local_node and
|
|
.[0].metadata.uid == $local_node_uid
|
|
' >/dev/null 2>&1 <<<"$nodes_json"
|
|
}
|
|
|
|
_ksre_run_restore_status_validator() {
|
|
/usr/bin/bash "$KSRE_STATUS_VALIDATOR" --expect-reencrypted-restore \
|
|
--verified-output-dir "$1" >/dev/null
|
|
}
|
|
|
|
_ksre_current_user_api_ready() {
|
|
local context="$1" server="$2"
|
|
/usr/bin/timeout --signal=TERM --kill-after=1s 9s \
|
|
/usr/bin/env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY -u NO_PROXY \
|
|
-u http_proxy -u https_proxy -u all_proxy -u no_proxy \
|
|
"$KSRE_KUBECTL" --context="$context" --server="$server" \
|
|
get --raw=/readyz >/dev/null 2>&1
|
|
}
|
|
|
|
_ksre_current_user_nodes_json() {
|
|
local context="$1" server="$2"
|
|
/usr/bin/timeout --signal=TERM --kill-after=1s 15s \
|
|
/usr/bin/env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY -u NO_PROXY \
|
|
-u http_proxy -u https_proxy -u all_proxy -u no_proxy \
|
|
"$KSRE_KUBECTL" --context="$context" --server="$server" \
|
|
get nodes -o json 2>/dev/null
|
|
}
|
|
|
|
_ksre_current_user_secret_count() {
|
|
local context="$1" server="$2"
|
|
/usr/bin/timeout --signal=TERM --kill-after=1s 30s \
|
|
/usr/bin/env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY -u NO_PROXY \
|
|
-u http_proxy -u https_proxy -u all_proxy -u no_proxy \
|
|
"$KSRE_KUBECTL" --context="$context" --server="$server" \
|
|
get secrets --all-namespaces -o json 2>/dev/null |
|
|
_ksre_secret_count_from_stream
|
|
}
|
|
|
|
_ksre_live_restore_inventory() {
|
|
local context="$1" connection="$2" server
|
|
local handoff inventory nodes version datastore encryption rotation hashes integrity
|
|
local local_node local_node_uid local_node_ready
|
|
local api_ready node_ready secret_count rc=0
|
|
_ksre_validate_current_connection "$connection" || return 1
|
|
server="${connection%|}"
|
|
handoff="$(/usr/bin/mktemp -d /tmp/platform-k3s-encryption.XXXXXX)" || return 1
|
|
/usr/bin/chmod 0700 "$handoff" || { /bin/rm -rf -- "$handoff"; return 1; }
|
|
if ! _ksre_run_restore_status_validator "$handoff"; then
|
|
/bin/rm -rf -- "$handoff"; return 1
|
|
fi
|
|
inventory="$handoff/inventory.env"
|
|
version="$(_ksre_inventory_value "$inventory" version)" || rc=1
|
|
datastore="$(_ksre_inventory_value "$inventory" datastore)" || rc=1
|
|
encryption="$(_ksre_inventory_value "$inventory" encryption)" || rc=1
|
|
rotation="$(_ksre_inventory_value "$inventory" rotation)" || rc=1
|
|
hashes="$(_ksre_inventory_value "$inventory" server_hashes)" || rc=1
|
|
integrity="$(_ksre_inventory_value "$inventory" integrity)" || rc=1
|
|
local_node="$(_ksre_inventory_value "$inventory" node_name)" || rc=1
|
|
local_node_uid="$(_ksre_inventory_value "$inventory" node_uid)" || rc=1
|
|
local_node_ready="$(_ksre_inventory_value "$inventory" node_ready)" || rc=1
|
|
/bin/rm -rf -- "$handoff"
|
|
(( rc == 0 )) || return 1
|
|
[[ "$encryption" == Enabled && "$local_node_ready" == Ready ]] || return 1
|
|
if _ksre_current_user_api_ready "$context" "$server"; then api_ready=pass; else return 1; fi
|
|
nodes="$(_ksre_current_user_nodes_json "$context" "$server")" || return 1
|
|
_ksre_require_same_ready_node "$local_node" "$local_node_uid" "$nodes" || return 1
|
|
node_ready=pass
|
|
secret_count="$(_ksre_current_user_secret_count "$context" "$server")" || return 1
|
|
[[ "$secret_count" =~ ^[0-9]+$ ]] || return 1
|
|
_ksre_require_same_connection "$context" "$connection" || return 1
|
|
printf '%s|%s|enabled_stable|%s|%s|%s|%s|%s|%s\n' \
|
|
"$version" "$datastore" "$rotation" "$hashes" "$integrity" \
|
|
"$api_ready" "$node_ready" "$secret_count"
|
|
}
|
|
|
|
_ksre_isolation_attested() {
|
|
local context="$1" answer
|
|
[[ -t 0 ]] || return 1
|
|
printf '격리·egress 차단 시험 완료 후 Type ISOLATED %s: ' "$context" >&2
|
|
IFS= read -r answer
|
|
[[ "$answer" == "ISOLATED $context" ]]
|
|
}
|
|
|
|
_ksre_output_target_absent() {
|
|
local output="$1" parent base
|
|
[[ -n "$output" && ! -e "$output" && ! -L "$output" ]] || return 1
|
|
if [[ "$output" == */* ]]; then parent="${output%/*}"; base="${output##*/}"
|
|
else parent='.'; base="$output"; fi
|
|
[[ -n "$parent" && -n "$base" && "$base" != . && "$base" != .. ]] || return 1
|
|
[[ -d "$parent" && ! -L "$parent" ]] || return 1
|
|
}
|
|
|
|
_ksre_write_output() {
|
|
local output="$1" content="$2" kind="$3" parent base temporary
|
|
_ksre_output_target_absent "$output" || return 1
|
|
if [[ "$output" == */* ]]; then parent="${output%/*}"; base="${output##*/}"
|
|
else parent='.'; base="$output"; fi
|
|
temporary="$(/usr/bin/mktemp "${parent}/.${base}.tmp.XXXXXX")" || return 1
|
|
/usr/bin/chmod 0600 "$temporary" || { /bin/rm -f -- "$temporary"; return 1; }
|
|
printf '%s\n' "$content" >"$temporary" || { /bin/rm -f -- "$temporary"; return 1; }
|
|
declare -A verification=()
|
|
_ksre_parse_external_file "$kind" "$temporary" verification || { /bin/rm -f -- "$temporary"; return 1; }
|
|
/bin/ln -- "$temporary" "$output" 2>/dev/null || { /bin/rm -f -- "$temporary"; return 1; }
|
|
/bin/rm -f -- "$temporary"
|
|
}
|
|
|
|
_ksre_evidence_target_absent() {
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/test ! -e "$KSRE_EVIDENCE" &&
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/test ! -L "$KSRE_EVIDENCE"
|
|
}
|
|
|
|
_ksre_prompt_destroyed() {
|
|
local answer
|
|
[[ -t 0 ]] || return 1
|
|
printf '일회용 환경과 bundle 복사본 파기 후 Type DESTROYED default: ' >&2
|
|
IFS= read -r answer
|
|
[[ "$answer" == 'DESTROYED default' ]]
|
|
}
|
|
|
|
_ksre_install_evidence() {
|
|
local content="$1" local_file root_temporary
|
|
local_file="$(/usr/bin/mktemp /tmp/platform-k3s-restore-evidence.XXXXXX)" || return 1
|
|
/usr/bin/chmod 0600 "$local_file" || { /bin/rm -f -- "$local_file"; return 1; }
|
|
printf '%s\n' "$content" >"$local_file" || { /bin/rm -f -- "$local_file"; return 1; }
|
|
declare -A verification=()
|
|
_ksre_parse_external_file evidence "$local_file" verification || { /bin/rm -f -- "$local_file"; return 1; }
|
|
root_temporary="${KSRE_EVIDENCE}.new.$$"
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/test ! -e "$KSRE_EVIDENCE" || { /bin/rm -f -- "$local_file"; return 1; }
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/install -o root -g root -m 0600 -- \
|
|
"$local_file" "$root_temporary" || { /bin/rm -f -- "$local_file"; return 1; }
|
|
/usr/bin/sudo --non-interactive -- /usr/bin/cmp --silent -- "$local_file" "$root_temporary" || {
|
|
/usr/bin/sudo --non-interactive -- /bin/rm -f -- "$root_temporary" >/dev/null 2>&1 || :
|
|
/bin/rm -f -- "$local_file"; return 1
|
|
}
|
|
if ! /usr/bin/sudo --non-interactive -- /bin/ln -- "$root_temporary" "$KSRE_EVIDENCE" 2>/dev/null; then
|
|
/usr/bin/sudo --non-interactive -- /bin/rm -f -- "$root_temporary" >/dev/null 2>&1 || :
|
|
/bin/rm -f -- "$local_file"; return 1
|
|
fi
|
|
/usr/bin/sudo --non-interactive -- /bin/rm -f -- "$root_temporary" || return 1
|
|
/bin/rm -f -- "$local_file"
|
|
}
|
|
|
|
_ksre_render_result() {
|
|
local -n bundle_fields="$1"
|
|
local tested_at="$2"
|
|
printf 'schema=platform-k3s-restore-result-v1\nbundle_id=%s\nk3s_version=%s\ndatastore=%s\nstatus_class=enabled_stable\nrotation_stage=reencrypt_finished\nhashes=match\nlocal_integrity=match\napi_ready=pass\nnode_ready=pass\nisolation=pass\nsecret_count_match=pass\ntested_at_utc=%s\n' \
|
|
"${bundle_fields[bundle_id]}" "${bundle_fields[k3s_version]}" "${bundle_fields[datastore]}" "$tested_at"
|
|
}
|
|
|
|
_ksre_render_evidence() {
|
|
local -n bundle_fields="$1" result_fields="$2"
|
|
local recorded_at="$3"
|
|
printf 'schema=platform-k3s-restore-evidence-v1\nbundle_id=%s\nk3s_version=%s\ndatastore=%s\nrotation_stage=reencrypt_finished\nlocal_integrity=match\nnode_ready=pass\nisolation=pass\ntested_at_utc=%s\nrecorded_at_utc=%s\ndestroyed=confirmed\n' \
|
|
"${bundle_fields[bundle_id]}" "${bundle_fields[k3s_version]}" "${bundle_fields[datastore]}" \
|
|
"${result_fields[tested_at_utc]}" "$recorded_at"
|
|
}
|
|
|
|
_ksre_emit_result() {
|
|
local metadata="$1" output="$2" context connection live tested_at content
|
|
local version datastore status rotation hashes integrity api node count
|
|
declare -A bundle=()
|
|
context="$(_ksre_current_context)" || return 1
|
|
[[ -n "$context" && "$context" != *$'\n'* ]] || return 1
|
|
connection="$(_ksre_current_connection "$context")" || return 1
|
|
_ksre_validate_current_connection "$connection" || return 1
|
|
_ksre_parse_external_file bundle "$metadata" bundle || return 1
|
|
[[ "${bundle[phase]}" == post ]] || return 1
|
|
_ksre_output_target_absent "$output" || return 1
|
|
live="$(_ksre_live_restore_inventory "$context" "$connection")" || return 1
|
|
IFS='|' read -r version datastore status rotation hashes integrity api node count <<<"$live"
|
|
[[ "$version" == "${bundle[k3s_version]}" && "$datastore" == "${bundle[datastore]}" &&
|
|
"$status" == enabled_stable && "$rotation" == reencrypt_finished && "$hashes" == match &&
|
|
"$integrity" == match && "$api" == pass && "$node" == pass &&
|
|
"$count" == "${bundle[secret_count]}" ]] || return 1
|
|
_ksre_isolation_attested "$context" || return 1
|
|
_ksre_require_same_connection "$context" "$connection" || return 1
|
|
_ksre_require_same_context "$context" || return 1
|
|
tested_at="$(_ksre_now_rfc3339)" || return 1
|
|
content="$(_ksre_render_result bundle "$tested_at")" || return 1
|
|
_ksre_write_output "$output" "$content" result
|
|
}
|
|
|
|
_ksre_record() {
|
|
local metadata="$1" result_file="$2" context recorded_at content
|
|
declare -A bundle=() result=() authority=() verification=()
|
|
context="$(_ksre_current_context)" || return 1
|
|
[[ -n "$context" && "$context" != *$'\n'* ]] || return 1
|
|
_ksre_parse_external_file bundle "$metadata" bundle || return 1
|
|
_ksre_parse_external_file result "$result_file" result || return 1
|
|
[[ "${bundle[phase]}" == post && "${result[bundle_id]}" == "${bundle[bundle_id]}" &&
|
|
"${result[k3s_version]}" == "${bundle[k3s_version]}" &&
|
|
"${result[datastore]}" == "${bundle[datastore]}" ]] || return 1
|
|
_ksre_age_within "${result[tested_at_utc]}" 86400 || return 1
|
|
_ksre_read_authoritative_bundle authority || return 1
|
|
_ksre_bundle_equal bundle authority || return 1
|
|
_ksre_evidence_target_absent || return 1
|
|
_ksre_prompt_destroyed || return 1
|
|
_ksre_require_same_context "$context" || return 1
|
|
recorded_at="$(_ksre_now_rfc3339)" || return 1
|
|
content="$(_ksre_render_evidence bundle result "$recorded_at")" || return 1
|
|
_ksre_parse_trusted_content evidence "$content" verification || return 1
|
|
_ksre_install_evidence "$content"
|
|
}
|
|
|
|
_ksre_check() {
|
|
local context connection live version datastore status rotation hashes integrity api node count
|
|
declare -A authority=() evidence=()
|
|
context="$(_ksre_current_context)" || return 1
|
|
[[ -n "$context" && "$context" != *$'\n'* ]] || return 1
|
|
connection="$(_ksre_current_connection "$context")" || return 1
|
|
_ksre_validate_current_connection "$connection" || return 1
|
|
_ksre_read_authoritative_bundle authority || return 1
|
|
_ksre_read_installed_evidence evidence || return 1
|
|
[[ "${authority[phase]}" == post &&
|
|
"${evidence[bundle_id]}" == "${authority[bundle_id]}" &&
|
|
"${evidence[k3s_version]}" == "${authority[k3s_version]}" &&
|
|
"${evidence[datastore]}" == "${authority[datastore]}" ]] || return 1
|
|
_ksre_age_within "${evidence[tested_at_utc]}" 2592000 || return 1
|
|
live="$(_ksre_live_restore_inventory "$context" "$connection")" || return 1
|
|
IFS='|' read -r version datastore status rotation hashes integrity api node count <<<"$live"
|
|
[[ "$version" == "${evidence[k3s_version]}" && "$datastore" == "${evidence[datastore]}" &&
|
|
"$status" == enabled_stable && "$rotation" == reencrypt_finished &&
|
|
"$hashes" == match && "$integrity" == match && "$api" == pass && "$node" == pass ]] || return 1
|
|
_ksre_require_same_context "$context"
|
|
}
|
|
|
|
k3s_secret_encryption_restore_evidence_main() {
|
|
local mode='' metadata='' result_file='' output=''
|
|
while (( $# > 0 )); do
|
|
case "$1" in
|
|
--emit-result|--record|--check)
|
|
[[ -z "$mode" ]] || { _ksre_usage >&2; return 2; }
|
|
mode="$1"; shift
|
|
;;
|
|
--bundle-metadata)
|
|
[[ $# -ge 2 && -z "$metadata" ]] || { _ksre_usage >&2; return 2; }
|
|
metadata="$2"; shift 2
|
|
;;
|
|
--result-file)
|
|
[[ $# -ge 2 && -z "$result_file" ]] || { _ksre_usage >&2; return 2; }
|
|
result_file="$2"; shift 2
|
|
;;
|
|
--output)
|
|
[[ $# -ge 2 && -z "$output" ]] || { _ksre_usage >&2; return 2; }
|
|
output="$2"; shift 2
|
|
;;
|
|
-h|--help) _ksre_usage; return 0 ;;
|
|
*) _ksre_usage >&2; return 2 ;;
|
|
esac
|
|
done
|
|
case "$mode" in
|
|
--emit-result)
|
|
[[ -n "$metadata" && -n "$output" && -z "$result_file" ]] || { _ksre_usage >&2; return 2; }
|
|
_ksre_emit_result "$metadata" "$output" || _ksre_fail
|
|
;;
|
|
--record)
|
|
[[ -n "$metadata" && -n "$result_file" && -z "$output" ]] || { _ksre_usage >&2; return 2; }
|
|
_ksre_record "$metadata" "$result_file" || _ksre_fail
|
|
;;
|
|
--check)
|
|
[[ -z "$metadata" && -z "$result_file" && -z "$output" ]] || { _ksre_usage >&2; return 2; }
|
|
_ksre_check || _ksre_fail
|
|
;;
|
|
*) _ksre_usage >&2; return 2 ;;
|
|
esac
|
|
}
|
|
|
|
if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
|
|
PATH="$KSRE_SECURE_PATH"
|
|
export PATH
|
|
k3s_secret_encryption_restore_evidence_main "$@"
|
|
fi
|